Yüksek CVSS 8.8

CVE-2024-35955: Linux Kernel: serbest bırakılmış belleğin kullanımı

Yayın: 20 Mayıs 2024 13:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.

Özet bilgiler

Ürün: Linux Linux Kernel
CVSS v3.1: 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: %1,18 (yüzdelik 68)
CWE: CWE-416
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
linux-linux-kernel	4.14.291	—	4.15
linux-linux-kernel	4.19.256	—	4.19.313
linux-linux-kernel	5.4.211	—	5.4.275
linux-linux-kernel	5.10.137	—	5.10.216
linux-linux-kernel	5.15.61	—	5.15.157
linux-linux-kernel	5.18.18	—	5.19
linux-linux-kernel	5.19.2	—	6.1.87
linux-linux-kernel	6.2	—	6.6.28
linux-linux-kernel	6.7	—	6.8.7
linux-linux-kernel	6.9	6.9	—
linux-linux-kernel	6.9	6.9	—
linux-linux-kernel	6.9	6.9	—
debian-debian-linux	10.0	10.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları